CISSP > Software Dev Sec > Flashcards

Software Dev Sec Flashcards

(98 cards)

Study These Flashcards
1
Q

ORB

A

Object request broker: used to locate object; object search engines; middleware; include COM, DCOM, CORBA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Defined

A

s/w process for both mgt and engineering activites id socumented, standardized and integrated into standard s/w process for org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

genetic programming

A

seeks to replicate nature’s evolution; creates random programs and assigns them a task of solving a problem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

4 s/w freedoms

A

freedom to 1. use the s/w for any purpose 2. change the s/w to suit your needs 3. share the s/w w/ friends and neighbors 4. share the changes you make

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

compilers

A

take source code, such as C or basic and compile it into machine code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

PHP RFI

A

PHP Remote file inclusion: altering normal PHP URLs and variables to include and execute remote content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

optimized

A

continual process improvement is enabled by quantitative feedback from the process and from piloting innovative ideas and technologies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

repeatable

A

basic proj mgt process are establishe to track cost, schedule, and funtionality; necessary process discipline is in place to repeat earlier successes on similar projects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ANN

A

artificial neural networks: expert system that simulates neural networks found in humans and animals; seek to duplicate biological neural networks; leanrs by example via training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

types of CASE software

A
  1. tools: support onlyl specific tasks in s/w production process 2. workbenches: support 1 or a few s/w process activities by integrating several tools in a single application 3. environments: support all or at least part of the s/w production process w/collection of tools and workbenches
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

bayesian filtering

A

commonly used to ID spam

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Agile Manifesto values

A
  1. individuals and interactions over process and tools 2 working s/w over comprehensive doc 3. customer collaboration over contract negotiation 4. responding to change over following a plan
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

scrum

A

named for way Rugby is played. No baton race in track, instead whole team works to move the project by passing ball back and forth as needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

datawarehouse

A

large collection of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

COM

A

component object model: ORB that locates objects on a local system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SQL injection

A

manipulation of a back end SQL server via a front end web server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

s/w testing levels

A

unit, installation, integration, regression, acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

white box s/w testing

A

gives the tester access to program source code, data structures, variables, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

XSS

A

cross site scripting: leverages third-party execution of web scripting languages such as javascript within the security context of a trusted site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

source code

A

computer programming language instructions that are written in text that must be translated into machine code before execution by the CPU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

open source

A

software publishes source code publicly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

expert systems

A
  1. knowledge base of if/then statements 2. inference engine that follows the tree formed by knowledge base and fires a rule when there is a match
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

traceability matrix

A

used to map customer’s req’ts to s/w testing plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

primary key

A

unique value in each tuple in a table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
black box testing
gives test no internal details
17
dynamic testing
tests the code while executing it
17
installation testing
testing s/w as it is installed and first operated
19
4GL
fourth generation language: computer languages designed to increase programmer's efficiency by automating creation of computer code; GUI focused; focus on creation of databases, reports, websites
20
closed source
software is typically released in executable form
22
average # mistakes in computer code
10-50 mistakes per 1000 lines of code
23
database replication
mirrors a live database, allowing simultaneous reads and writes to multiple replicated databases by clients
24
relational database
contains 2-dimensional tables of related data
25
privilege escalation
allow an attacker with (typically limited) access to be able to access additional resources
26
shareware
fully functional proprietary s/w that may be initially used free, but requires you to pay if you continue to use it
26
normalization
seeks to make the data in a database table logically concise, organized, and consistent.
28
interpreted languages
compiled on the fly each time the program is run
29
integration testing
testing multiple s/w components as they are combined into a working system; subsets may be tested, or big bang integration testing tests all integrated s/w components
30
entity integrity
each tuple has a unique primary key that is not null
32
crippleware
partially functioning proprietary s/w, often with key features disabled; must pay to get the full bologna
33
assembly language
low-level computer programming laguage; uses short mnemonics that match to machine language instructions
33
referential integrity
every foreign key in a secondary table matches a primary key in the parent table
34
RAD
rapid application development: develops s/w via use of prototypes, dummy GUIs, back-end databases; goal is quickly meeting business needs of the suystem, technical concerns are secondary
35
Object
a "black box" that combines code and data and sends and receives messages
36
genetic algorithms
refer to creating shorter pieces of code called chromosomes
37
foreign key
key in a related database table that matches a primary key in a parent database; foreign key is the local table's primary key
37
database view
results of a database query
39
DCOM
distributed common object model: ORB that locates objects over a network
40
CASE
computer aided software engineering: uses programs to assist in the creation and mx of other computer programs
41
TD
top down programming: startes with broadest and highest level requirements and works down toward the low-=level technical implementation details
42
responsible disclosure
practice of privately sharing vulnerability info with a vendor and w/holding public release until a patch is available
43
combinatorial s/w testing
black-box testing method that seeks to ID and test all unique combinations of s/w inputs
44
managed
detaield measures of the s/w process nd product quality are collected, analyzed, and used to control the processs; s/w process and products are quantitively understood and controlled
45
machine code
software that is executed directly by the CPU; series of 1's and 0's that translate to instructions understood by CPU
46
data integrity
databases must ensure the intregrity of the data in the tables
47
data dictionary
description of the database tables; aka meta data
48
database schema
describes the attributes and values of the database tables
49
backdoors
shortcuts in a system that allow a user to bypass seucirty checks
50
DML
data manipulation language: used to query and update data stored in the tables
52
coupling
highly coupled object requires lots of other objects to perform basic jobs, like math; inversely related to cohesion
53
waterfall model
an application development model that uses rigid phases; when one phase ends, the next begins; cannot go back to previous steps;
54
steps of SDLC
prepare sucirty plan, initiation, development/acq, implementation, ops/mx, disposal
56
spiral model
software development model designed to dcontrol risk
57
sashimi model
highly overlapping steps; real-world successor to watefall model; named for overlapping fish dish called sashimi
58
shadow database
like a replicated database except shadows mirror all changes to primary database, clients can't access the shadow
60
static testing
tests code passively; code isn't running; includes walkthroughs, syntax checking, code reviews
61
XP core practices
1 palnning: specifies desired features (user story) 2. paired programming: programmers work in teams 3. 40-hr week: accurate forecast of work 4. total customer involvement: customer always available and monitors proj 5. detailed test procedures aka unit tests
61
CORBA
common object request borker architecture: ORB; open vendor-neutral networked object broker framework; enforces fundamental OO design as low-level deatails are encapsulated from client
62
regression testing
testing s/w after updates, modifications, or patches
63
BU
bottom up programming: starts w/ low-level technical implementation details and works up to the concept of the complete program
64
SDLC
system or software development lifecycle model: development model that focuses on security in every phase
65
programming languge generations
1st: machine code 2nd: Assemby 3rd: COBOL, C Basic 4th: ColdFusion, Progress 4GL, Oracle Reports
66
agile software development
evolved as reaction to rigid s/w dev models such as waterfall model; includes Scrum and XP
67
DDL
data defined language: used to create, modify, and delete tables
68
fuzzing
type of black box testing that enters random, malformed data as inputs into software programs to determine if they will crash
69
CMM
software capability maturity model: 5 levels: initial, repeatable, defined, managed, optimizing
70
XP improvements
1. communication 2. simplicity 3. feedback 4. respect 5. courage
71
unit testing
low-level tests of s/w components, such as functions, procedures, or objects
72
prototyping
iterative apprach that breaks projects into smaller tasks creating multiple mockups of system design features
74
procedural languages
programming languages that use subroutines, procedures, and functions
76
database
structured collection of related data
77
tuple
a row in a relational database
79
cohesion
very independent object; inversely related to coupling
80
buffer overflow
occurs when a programmer does not perform variable bounds checking
81
OOP
Object Oriented Programming: changes the older procedural progrmaming methodology and treats programs as a series of connected objects that comm via messages, uses encapsulation
83
XP
Extreme Programming: an agile development method that uses pairs of programmers who work off a detailed specification
84
initial
characterized as ad hoc and occasionally even chaotic; few process defined and success depends on individual effort
85
full disclosure
controversial practice of releasing vulnerability details publicly
86
data mining
search for patterns in data
88
acceptance testing
testing to sendure s/w meets the customer's operational req'ts; when done by customer is called user acceptance testing
89
freeware
aka "gratis" software; free as in beer; free of charge to use
90
directory path traversal
escaping from the root of a web server into the regular file system by referencing directories
91
polyinstantiation
two instances with the same name can contain different data; useful in multilevel security environments
92
hard-coded credentials
backdoor username/passwords left by programmers in production code
94
waterfall steps (general)
req'ts, analysis, design, code, test, ops, and then destruction which he left off
95
semantic integrity
each attribute value is consistent with the attribute data type
96
attribute
a column in a relational database
97
hierarchical databases
form a tree
98
sprial model
designed to conttrol risk; repeats steps of a proejcts in ever-wider spirals called rounds
CISSP
flashcards
Decks in class (11)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions